Dashboards & Visualizations

Why is the chart command not working properly?

zacksoft
Contributor

sample event

10.138.258.78 522x533587x10 JOHNNY [20/Jun/2018:08:42:23 -0400] "GET /rest/redbopper/1.0/xboard/work/allData.json?rapidViewId=9124&selectedProjectKey=BMRIEMARED&etag=9128%2C1529498111000%2C%5B%5D%2C%5B%5D%2C560&_=1529498542404 HTTP/1.1" 200 181 748 "https://phutan.mayhem.com/secure/ActiveBoard.jspa?superView=9024" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36" "ihb3tl"

The number in bold indicates the response time and JOHNNY is the user. I wanted to get a chart drawn of the response time of all the transactions of the user. Here is my query. But I am not able to use the chart command properly.

sourcetype="Zaccess" host=A OR host=B NOT host=C AND JOHNNY
| eval headers=split(_raw," ")
 | eval username=mvindex(headers,2) 
| eval method=mvindex(headers,5)
 | eval Request=mvindex(headers,6) 
| eval Status=mvindex(headers,8) 
| eval req_time=mvindex(headers,10) 
| eval uri=mvindex(headers,11)
 | eval Method=replace(method,"\"","") 
| eval uri=replace(uri,"\"","") 
| eval Run_Time = req_time*0.001
 | rex field=_raw "\"(?[^\s]+)\"$"
 | eval c_time=strftime(_time,"%m/%d/%y %H:%M:%S") 

Also, is it possible to input the username as a parameter as a dashboard input instead of hardcoding it in the query?

0 Karma
1 Solution

renjith_nair
Legend

Hi @zacksoft,

Does this work for you ?

|stats count|eval _raw="10.138.258.78 522x533587x10 JOHNNY [20/Jun/2018:08:42:23 -0400] \"GET /rest/redbopper/1.0/xboard/work/allData.json?rapidViewId=9124&selectedProjectKey=BMRIEMAREDηg=9128%2C1529498111000%2C%5B%5D%2C%5B%5D%2C560&_=1529498542404 HTTP/1.1\" 200 181 748 \"https://phutan.mayhem.com/secure/ActiveBoard.jspa?superView=9024\" \"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36\" \"ihb3tl\""
|rex "^(?:[^ \n]* ){2}(?P<user>\w+)"|rex "^(?:[^ \n]* ){10}(?P<resp_time>\d+)"|rex "^[^ \n]* (?P<txn_id>[^ ]+)"
|fields user,resp_time,txn_id|stats max(resp_time) by txn_id

Only last 2 lines are processing data.

Yes you could use parameter for user name in dashboard using tokens. Refer to Define_tokens_for_form_inputs

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Hi @zacksoft,

Does this work for you ?

|stats count|eval _raw="10.138.258.78 522x533587x10 JOHNNY [20/Jun/2018:08:42:23 -0400] \"GET /rest/redbopper/1.0/xboard/work/allData.json?rapidViewId=9124&selectedProjectKey=BMRIEMAREDηg=9128%2C1529498111000%2C%5B%5D%2C%5B%5D%2C560&_=1529498542404 HTTP/1.1\" 200 181 748 \"https://phutan.mayhem.com/secure/ActiveBoard.jspa?superView=9024\" \"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36\" \"ihb3tl\""
|rex "^(?:[^ \n]* ){2}(?P<user>\w+)"|rex "^(?:[^ \n]* ){10}(?P<resp_time>\d+)"|rex "^[^ \n]* (?P<txn_id>[^ ]+)"
|fields user,resp_time,txn_id|stats max(resp_time) by txn_id

Only last 2 lines are processing data.

Yes you could use parameter for user name in dashboard using tokens. Refer to Define_tokens_for_form_inputs

---
What goes around comes around. If it helps, hit it with Karma 🙂

zacksoft
Contributor

Thank you super very much.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...